Cyber security procurement has moved from a technical afterthought to a board-level concern. Cyber threats are an immediate risk to every organisation, regardless of size or sector. The UK Government's Cyber Security Breaches Survey 2025/2026 found that 43% of UK businesses had experienced a breach or attack in the previous 12 months.

The question is no longer whether to invest in cyber security, but how to invest wisely. Whether you are on the customer or supplier side, that means understanding what buyers should ask for and what suppliers must be able to show.

Cyber security procurement is the process of buying security products and services, and of making sure every supplier you buy from meets an appropriate security standard. It covers defining requirements, checking accreditations such as Cyber Essentials and ISO 27001, assessing supplier cyber risk, evaluating providers and writing security obligations into the contract.

What Cyber Security Procurement Covers

The term is used in two ways, and a sound approach deals with both.

• Buying cyber security services – Procuring the tools and expertise that protect your organisation, such as managed detection and response, penetration testing, incident response, consultancy and security software.
• Securing what you buy from everyone else – Making sure that any supplier with access to your systems or data, from a payroll provider to a facilities contractor, does not become the weak point in your defences.

The second is where many organisations are exposed. Incidents such as the SolarWinds attack and the MOVEit Transfer vulnerability showed how a single compromised supplier can affect hundreds of customers. Good procurement security means building checks in from the start. At each stage of the procurement process, security requirements should be stated, tested and recorded.

It is also worth resisting the urge to buy every new tool on the market. Each new product needs secure integration with existing systems, staff training and ongoing management, and a cluttered security stack can increase your attack surface. A needs-based approach starts with a risk assessment, maps the controls you need to a recognised framework, checks what your current tools already cover, and only then goes to market.

Supplier Cyber Requirements: Cyber Essentials, ISO 27001 and Public Sector Rules

Buyers generally rely on a small number of recognised standards to set a minimum level of supplier security. If you are a supplier, these are the requirements you are most likely to meet in a tender.

Cyber Essentials and Cyber Essentials Plus

Cyber Essentials is the government-backed scheme overseen by the National Cyber Security Centre (NCSC). Certification is delivered by IASME, the NCSC's Cyber Essentials Delivery Partner, through a network of certification bodies. It gives buyers a practical way to confirm that a supplier has the fundamental technical controls in place. The five controls are:

• Firewalls – Boundary firewalls and internet gateways configured to protect the network.
• Secure configuration – Devices and software set up to reduce vulnerabilities.
• Security update management – Software and devices kept up to date with security patches.
• User access control – Access restricted to what each role needs.
• Malware protection – Anti-malware measures deployed and maintained.

Cyber Essentials is a verified self-assessment. Cyber Essentials Plus covers the same five controls but adds independent technical testing to confirm they work in practice.

ISO 27001

ISO 27001 is the international standard for an information security management system. It is broader than Cyber Essentials, covering governance, risk management, people and supplier relationships as well as technical controls. Buyers tend to ask for it where a supplier will handle large volumes of sensitive data or deliver a critical service.

Public Sector Requirements

In central government, Cyber Essentials is mandatory for certain contracts. Procurement Policy Note 014 applies to central government departments, their executive agencies, non-departmental public bodies and NHS bodies. It requires suppliers bidding for contracts that involve personal information or certain ICT systems to hold Cyber Essentials or Cyber Essentials Plus, or to show equivalent controls, before award.

Where Cyber Essentials is required, the supplier must renew it annually for the life of the contract. MOD contracts apply their own Cyber Security Model on top of this, giving each contract a cyber risk profile that sets the controls a supplier must meet. Accreditation is only part of the picture, because buyers will usually also ask to see your cyber security policies, such as information security, access control and incident response.

Need cyber policies that pass procurement checks? Talk to us.

Assessing Supplier Cyber Risk

Certification tells you a supplier met a standard on a given date. A supplier cyber risk assessment tells you whether that is enough for the contract in question. A proportionate process has four parts:

1. Tier your suppliers. Rank each supplier by the data they hold, the system access they have and how critical the service is. Spend your effort on the highest tier.
2. Issue a questionnaire. Use a standard set of questions covering access controls, encryption, incident response, business continuity and subcontractors.
3. Ask for evidence. Request certificates, policy documents, recent penetration test summaries and details of past incidents and how they were handled.
4. Score and decide. Rate each area, for example as low, medium or high risk, and agree what must be fixed before contract signature and what can follow afterwards.

Supplier cyber risk is not a one-time assessment. It is advisable to set regular review cycles and to require suppliers to tell you about any material change to their security position.

How Much Does a Supplier Cyber Risk Assessment Cost?

The cost depends on the depth of the assessment. A questionnaire and evidence review carried out in-house costs staff time only. If you ask the supplier to certify, the NCSC lists Cyber Essentials from £320 plus VAT, with Cyber Essentials Plus quoted according to the size and complexity of the network. An independent audit or penetration test for a high-risk supplier is priced per engagement, so it is always worth agreeing in the tender who pays for it.

Which Data Should Procurement and Security Teams Collect?

Assessment works best when procurement, information security and legal teams share one supplier record instead of keeping separate spreadsheets. For each supplier, it is recommended that you hold:

• What data the supplier holds or can access, and where it is stored.
• Which of your systems they connect to, and how.
• Certifications held, with expiry dates.
• Questionnaire responses and the risk score given.
• Subcontractors involved in delivering the service.
• Incident history and agreed remediation actions.
• Contract end date and next review date.

How to Compare Cyber Security Providers

When you are buying security services themselves, price alone is a poor guide. Agree your evaluation criteria before you go to market and weight them to reflect your risks.

• Fit to requirement – Does the proposal address the risks in your assessment, or is it a standard package?
• Accreditation and assurance – Does the provider hold relevant certifications, and are its testers and consultants suitably qualified?
• Service levels – What are the response times for an incident, and are they backed by service credits?
• Integration – Will the service work with your existing tools, or replace them?
• Total cost of ownership – Include implementation, training, licensing and support, not only the purchase price.
• Exit – Can you retrieve your data and logs, and move to another provider without losing coverage?

Red flags include vague answers on incident history, reluctance to accept audit rights, heavy reliance on unnamed subcontractors, and pricing that only becomes clear after contract signature.

To justify the spend internally, a simple return on investment calculation helps:

ROI = (Total cost of expected risks − Total cost of solution) / Total cost of solution

Expected risk costs include breach response, regulatory fines, downtime, legal costs and lost customers. Solution costs include purchase, implementation, training and ongoing licensing.

Contract Clauses to Include in Cyber Security Contracts

The contract is where procurement and security come together. Requirements that were scored in the tender need to become enforceable obligations, in both cyber security contracts and any other contract where a supplier handles your data.

• Data protection – Where the supplier processes personal data, UK GDPR requires a written contract setting out the processing terms (Article 28). Specify encryption standards for data at rest and in transit.
• Incident notification – Require the supplier to notify you of a security incident within a defined period. You may have only 72 hours to report a notifiable personal data breach to the ICO, so the supplier's deadline needs to be shorter.
• Audit rights – Include the right to audit the supplier's security practices and to see penetration test results.
• Subcontractors – Require approval for subcontractors and the flow-down of the same security obligations to them.
• Certification – Make it a condition that Cyber Essentials, ISO 27001 or other agreed certifications are maintained throughout the term.
• Insurance and liability – Set minimum cyber insurance cover and check that liability caps reflect the potential loss.

The ICO can impose fines of up to £17.5m or 4% of annual global turnover, whichever is higher, so the liability position deserves care. Support with GDPR compliance helps on the data protection terms, and a contract review before signature will confirm the clauses work together.

Winning Cyber Security Tenders

For suppliers, the points above are the buyer's marking scheme in reverse. Buyers issuing cyber security tenders want evidence, not assurances.

• Get certified early – Certification can take weeks. Do not wait for the tender to be published.
• Keep an evidence pack – Hold current policies, certificates, test summaries and case studies ready to attach.
• Choose the right route to market – Much public sector demand goes through frameworks such as Cyber Security Services 3, a dynamic purchasing system run by the Crown Commercial Service / Government Commercial Agency (CCS / GCA). Its successor, Cyber Security 4, is in development.
• Answer the risk – Show how your service reduces the buyer's specific risks, with measurable service levels.

Examples of what this can achieve include £500k+ in cyber security deals secured across the public and private sectors, and three framework awards for a cyber security IT reseller. Specialist cyber security tender support can help where your team has the technical knowledge but not the time to write the bid.

Key Takeaway

Cyber security procurement is as much about who you buy from as what you buy. Set a clear minimum standard, assess suppliers in proportion to the risk they carry, and turn the answers into contract obligations. Suppliers who prepare their certifications and policies in advance are better placed to win.

How Athena Can Help

We support both sides of cyber security procurement. For buyers, we help define requirements, evaluate providers, review technology contracts and negotiate terms. For suppliers, we write the policies that procurement teams ask for and manage bids for cyber security work.

We assess your current position first, so that effort goes where the risk or the opportunity is greatest. Our approach is designed to minimise the load on your team.

Need cyber policies that pass procurement checks? Talk to us.

Frequently Asked Questions

How much does a supplier cyber risk assessment cost?

It depends on the depth required. An in-house questionnaire and evidence review costs staff time only, whilst certification or an independent audit of a high-risk supplier carries a fee that varies with the size and complexity of the supplier's systems. Agree who pays before the contract is signed.

Which data should information security and procurement teams collect to improve information security?

Collect a single record for each supplier showing the data they hold, the systems they access, their certifications and expiry dates, questionnaire results, subcontractors and incident history. Add the contract end date and next review date. Sharing this record between teams means risks are seen before a contract is renewed.

Is Cyber Essentials certification mandatory?

It is mandatory for suppliers bidding for certain central government and NHS contracts, particularly those involving personal information or specified ICT systems. Outside those contracts it is not a legal requirement, but many buyers now ask for it as a minimum standard.

How do I assess a supplier's cyber security posture during procurement?

Start by verifying certifications such as Cyber Essentials and ISO 27001. Issue a standard security questionnaire covering access controls, encryption, incident response and business continuity. For high-risk suppliers, request evidence of recent penetration testing and review their incident history.

How often should you review your cyber security procurement strategy?

At least once a year. You should also review it after a significant security incident, a change in regulation, or a major change in your supply chain. A strategy that was adequate 12 months ago may no longer be sufficient.